Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can the messages that scroll by when booting a Debian system be reviewed later?

In other words, how can I review absolutely all of them conveniently? That's the important point to the question; merely a subset of them is insufficient.

Some boot time messages are written only to /var/log/daemon.log and /var/log/syslog, where I have seen messages like: udevd[240]: SYSFS{}= will be removed in a future udev version.

In squeeze, these are not in /var/log/dmesg. Nor are they in /var/log/boot with setting BOOTLOGD_ENABLE=yes in /etc/default/bootlogd and package bootlogd installed.

For more details on rsyslogd's various logging locations see your /etc/rsyslog.conf.

share|improve this question

The boot messages come in two parts: those that come from the kernel (loading drivers, detecting partitions, etc) and those that come from the services starting up ([ OK ] Starting Apache...). The kernel messages are stored in /var/log/kern.log and can also be accessed from the kernel's own log buffer with the dmesg program.

The userspace messages are not stored anywhere unless you install the bootlogd package. It will log the service startup messages in /var/log/boot Note if you have the "fancy" boot messages (the colored [ OK ] [FAIL] etc messages), it will log the terminal escape codes in the file. You can disable the fancy boot messages by creating an /etc/ shell script which defines FANCYTTY=0 in it.

share|improve this answer
Rather than disabling the colored messages, you can view them using commands like sed 's/\^[/\o33/g;s/[1G[/[27G[/' /var/log/boot | less -r - see… – JosephH Apr 3 at 10:12
up vote 5 down vote accepted

Bootup messages pass by so fleetingly that, for some, one might not be sure what they say. You may wish to check all the files where they might be logged, in addition to the usual (well-known) log files, for verification purposes (at least).

On Debian, logs generally are kept in directory /var/log.

After booting, what changed there today (which files) can be seen in the Bash shell by:

sudo ls -ld --sort=time `sudo find /var/log -type f -daystart -ctime 0 | sed -r 's/^.*\.([0-9]+|old|gz)$//g'`

The scrolling output may contain interesting strings like 'will be removed'. Here's how to find them:

sudo grep -ilF 'will be removed' `sudo find /var/log -type f -daystart -ctime 0 | sed -r 's/^.*\.([0-9]+|old|gz)$//g' | sort` > log-list; sudo nano `cat log-list`

Boot-time logging can be enabled by:

apt-get install bootlogd

and edit /etc/default/bootlogd to contain


Unfortunately, bootlogd seems unavailable on squeeze.

For color information, see here.

share|improve this answer
As of Wheezy, bootlogd no longer requires the /etc/default/bootlogd config file, see here. – RolfBly Jul 2 '15 at 21:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.